SpaceXAI’s Grok Build AI coding tool was uploading users’ entire code repositories to Google Cloud without clear disclosure, the company confirmed, before disabling the behavior after it was publicly reported in July 2026.
Security research firm Cereblab published findings showing that the Grok Build command-line interface was packaging and sending complete code repositories to SpaceXAI’s servers — including files the tool had been instructed not to open and secrets that had been deleted from history. Researchers noted this represented significantly more data retention than comparable tools such as Claude Code.
As of Monday, Cereblab’s tests showed SpaceXAI’s servers returning a “disable_codebase_upload: true” flag, indicating the upload behavior had been turned off.
Elon Musk responded on X, stating that all data previously uploaded by Grok Build would be “completely and utterly deleted.” In a separate post, Musk said “privacy settings are always respected” but asked users to allow SpaceXAI to retain their data, describing it as “helpful for debugging issues.”
Dr. Lukasz Olejnik, an independent security researcher at King’s College London, told The Verge the level of data retention was “excessive.” He said the data potentially at risk could include “proprietary source code, information about security vulnerabilities, personal data, infrastructure details, [and] credentials.”
SpaceXAI initially pointed users to a “/privacy” command in the CLI as a way to disable data retention and delete previously synced data. However, Cereblab pushed back on that response, clarifying that “/privacy is a per-session retention toggle, not the switch that fixed this,” and should not be presented as the relevant control.
The incident raises concerns for developers who may have used Grok Build with codebases containing sensitive or proprietary information, as the scope of what was uploaded extended beyond what users would likely have anticipated.
Source: The Verge